Submission Details
Severity:
Lack of check for MAX_TOTAL_LOCKED_AMOUNT in veRAACToken::lock()
Summary
The lock function does not check if locking new amount of tokens will exceed the MAX_TOTAL_LOCKED_AMOUNT set in the contract.
Vulnerability Details
function lock(uint256 amount, uint256 duration) external nonReentrant whenNotPaused {
if (amount == 0) revert InvalidAmount();
if (amount > MAX_LOCK_AMOUNT) revert AmountExceedsLimit();
if (totalSupply() + amount > MAX_TOTAL_SUPPLY) revert TotalSupplyLimitExceeded();
if (duration < MIN_LOCK_DURATION || duration > MAX_LOCK_DURATION)
revert InvalidLockDuration();
// Do the transfer first - this will revert with ERC20InsufficientBalance if user doesn't have enough tokens
raacToken.safeTransferFrom(msg.sender, address(this), amount);
// Calculate unlock time
uint256 unlockTime = block.timestamp + duration;
// Create lock position
_lockState.createLock(msg.sender, amount, duration);
_updateBoostState(msg.sender, amount);
// Calculate initial voting power
(int128 bias, int128 slope) = _votingState.calculateAndUpdatePower(
msg.sender,
amount,
unlockTime
);
// Update checkpoints
uint256 newPower = uint256(uint128(bias));
_checkpointState.writeCheckpoint(msg.sender, newPower);
// Mint veTokens
_mint(msg.sender, newPower);
emit LockCreated(msg.sender, amount, unlockTime);
}
The lock function does not check if locking new tokens will exceed the MAX_TOTAL_LOCKED_AMOUNT, due to the lack of check, the contract can lock more than the MAX_TOTAL_LOCKED_AMOUNT that was proposed.
Impact
The veRAACToken contract can lock more than the MAX_TOTAL_LOCKED_AMOUNT tokens in the contract.
Tools Used
Manual Review
Recommendations
Add a check before locking new tokens, ensure that MAX_TOTAL_LOCKED_AMOUNT is not exceeded.
Updates
Lead Judging Commences
inallhonesty 4 months ago
Submission Judgement Published Assigned finding tags:
`veRAACToken::lock` function doesn't check MAX_TOTAL_LOCKED_AMOUNT
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.